{"id":"CVE-2026-102484","kind":"vulnerability","aliases":["CVE-2026-102484"],"related":[],"title":"NTPsec: JJY refclock overflow lets a time source crash or corrupt ntpd","description":"Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.","summary":"NTPsec's ntpd has a heap buffer overflow in its JJY reference clock driver, triggered when more than six time replies arrive from a Telephone JJY time source. An attacker controlling that time source can corrupt memory or crash ntpd.","severity":"medium","cvss":6.4,"epss":0.00264,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ntpsec","package","self-hosted","time-sync"],"not_affected_if":["default-config","no-jjy-refclock","ntp-pool-only"],"how_to_check":"- `ntpd --version` (or `ntpq -c version`) to read the NTPsec version\n- Check whether the config uses a `server 127.127.40.x` JJY refclock line (driver 40)","fix":"- Upgrade NTPsec to `1.2.6` or later\n- Until patched, remove the JJY refclock driver from the ntpd config if it is not needed","status":"open","published_at":"2026-10-21T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:59:21+00:00","updated_at":"2026-10-25T03:59:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NTPsec to `1.2.6` or later\n- Until patched, remove the JJY refclock driver from the ntpd config if it is not needed","reach":"network","title":"NTPsec: JJY refclock overflow lets a time source crash or corrupt ntpd","impact":"medium","summary":"NTPsec's ntpd has a heap buffer overflow in its JJY reference clock driver, triggered when more than six time replies arrive from a Telephone JJY time source. An attacker controlling that time source can corrupt memory or crash ntpd.","category":"package","nicknames":[],"who_cares":["ntpsec","self-hosted","time-sync"],"confidence":0.7,"needs_auth":"no","worst_case":"ntpd crashes or memory is corrupted via a hostile time source","analyst_note":"","how_to_check":"- `ntpd --version` (or `ntpq -c version`) to read the NTPsec version\n- Check whether the config uses a `server 127.127.40.x` JJY refclock line (driver 40)","needs_analyst":false,"not_affected_if":["default-config","no-jjy-refclock","ntp-pool-only"],"who_is_affected":"Only hosts running NTPsec ntpd before `1.2.6` with the JJY refclock driver configured are exposed. The attacker must control the Telephone JJY time source that the host reads from, so hosts that sync only to pools or other normal NTP servers are unlikely to be at risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3349,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102484':15A,18A '-2026':14A,17A '1.2.6':81C 'allow':82C 'arriv':48B 'attack':56B,84C 'base':69C 'buffer':33B,70C 'clock':39B 'control':57B,86C 'corrupt':11A,62B,93C 'crash':9A,65B,96C 'cve':13A,16A 'driver':40B,76C 'heap':32B,68C 'heap-bas':67C 'host':23B 'jji':2A,37B,52B,74C,89C 'let':5A 'memori':63B,94C 'ntpd':12A,29B,66B,79C,97C 'ntpsec':1A,19B,27B,78C 'overflow':4A,34B,71C 'packag':20B 'refclock':3A,75C 'refer':38B 'repli':47B,103C 'self':22B 'self-host':21B 'six':45B,101C 'sourc':8A,54B,60B,91C 'sync':26B 'telephon':51B,88C 'time':7A,25B,46B,53B,59B,90C,102C 'time-sync':24B 'trigger':41B 'via':98C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running NTPsec ntpd before `1.2.6` with the JJY refclock driver configured are exposed. The attacker must control the Telephone JJY time source that the host reads from, so hosts that sync only to pools or other normal NTP servers are unlikely to be at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102484","severity":null,"published_at":"2026-10-21T16:17:14+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102484","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102484","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}